THE LATEST / SECURITY & VULNERABILITIES
Threat News
Recent vulnerabilities and security advisories, straight from the source.
The complete recent NVD stream, including unscored entries. All entries link to the original publisher.
For severity filtering, choose All CVEs above. Scores are available for NVD entries when supplied by an assessor. A severity filter excludes unscored entries; choose “Unscored / not supplied” to see them. Severity describes technical impact, not exploitation or risk.
16,941 stories · Past 30 days · Newest first
Subscribe to this view · RSSSource updates
- NVDUp to date · Checked
- CISA · Known ExploitedUp to date · Checked
- CISA · IndustrialUp to date · Checked
- CERT-EUUp to date · Checked
Sources refresh hourly; NVD every two hours. Available stories remain readable while a source recovers.
- NVD
CVE-2026-67416 — RabbitMQ is a messaging and streaming broker. From 4.0.0 until 4.0.24, 4.1.15, 4.2.10, and 4.3.4, the optimized AMQP 1.0 ser…
Medium · CVSS 4.0 5.3 · Assessor: [email protected]
RabbitMQ is a messaging and streaming broker. From 4.0.0 until 4.0.24, 4.1.15, 4.2.10, and 4.3.4, the optimized AMQP 1.0 server_mode parser in deps/amqp10_common/src/amqp10_binary_parser.erl matches the textual prefixes of symbolic data, sequence, and value body descriptors without verifying their encoded symbol lengths. An authenticated AMQP 1.0 publisher with write permission can submit a well-formed unknown descriptor that begins with a registered body descriptor, and RabbitMQ misclassifies and stores the bytes…
CVE-2026-67416Read original ↗ (opens in a new tab) - NVD
CVE-2026-67414 — RabbitMQ is a messaging and streaming broker. From 4.0.0 until 4.0.24, 4.1.15, 4.2.10, and 4.3.4, deps/amqp10_common/src/amq…
Medium · CVSS 4.0 6.0 · Assessor: [email protected]
RabbitMQ is a messaging and streaming broker. From 4.0.0 until 4.0.24, 4.1.15, 4.2.10, and 4.3.4, deps/amqp10_common/src/amqp10_binary_parser.erl materializes each element of AMQP 1.0 arrays whose shared constructor has zero width, while limiting only the number of elements in each array and not the aggregate arrays in a frame. After completing SASL authentication, a low-privilege client can send an ordinary frame containing many individually permitted arrays, causing a small frame to expand into a very large read…
CVE-2026-67414Read original ↗ (opens in a new tab) - NVD
CVE-2026-62858 — YOURLS is a self-hosted, customizable URL shortener written in PHP. Prior to 1.10.5, yourls_get_request() extracted the requ…
Medium · CVSS 3.1 5.3 · Assessor: [email protected]
YOURLS is a self-hosted, customizable URL shortener written in PHP. Prior to 1.10.5, yourls_get_request() extracted the request path without sanitization, after which yourls_sanitize_url() and yourls_esc_url() preserved dot and slash traversal sequences before an attacker-controlled keyword reached file_exists() and include() under YOURLS_PAGEDIR. An unauthenticated remote attacker could traverse outside the intended pages directory and include a local PHP file that was already present on the server, such as an up…
CVE-2026-62858Read original ↗ (opens in a new tab) - NVD
CVE-2026-53615 — util-linux is a random collection of Linux utilities. Before util-linux 2.41.4, `parse_dos_extended()` in `libblkid/src/part…
High · CVSS 3.1 8.0 · Assessor: [email protected]
util-linux is a random collection of Linux utilities. Before util-linux 2.41.4, `parse_dos_extended()` in `libblkid/src/partitions/dos.c` computes an extended-partition start sector with 32-bit addition and does not apply the extended-area bounds checks to the first two EBR entries. A local attacker who causes a crafted DOS extended-partition disk image or removable medium to be probed can wrap `cur_start + start` to sector zero and cause libblkid to report a false partition overlapping the MBR. This directly comp…
CVE-2026-53615Read original ↗ (opens in a new tab) - NVD
CVE-2026-53614 — util-linux is a random collection of Linux utilities. In util-linux 2.39.1 through 2.41.4 and 2.42 through 2.42.1, the SUID…
High · CVSS 3.1 7.0 · Assessor: [email protected]
util-linux is a random collection of Linux utilities. In util-linux 2.39.1 through 2.41.4 and 2.42 through 2.42.1, the SUID `mount` utility reads the attacker-controlled `LIBMOUNT_FORCE_MOUNT2` environment variable with `getenv()`, allowing a local low-privileged user to force the non-atomic legacy bind-mount path. With an `/etc/fstab` bind mount authorized by `user` or `users` and protected by `nosuid`, `noexec`, or `nodev`, an attacker can race the window between the initial bind mount and the remount that appli…
CVE-2026-53614Read original ↗ (opens in a new tab) - NVD
CVE-2026-49206 — rapidcsv is a C++ CSV parser library. Prior to 8.99, RemoveColumn, InsertColumn, RemoveRow, InsertRow, and GetColumnNames co…
Low · CVSS 3.1 2.9 · Assessor: [email protected]
rapidcsv is a C++ CSV parser library. Prior to 8.99, RemoveColumn, InsertColumn, RemoveRow, InsertRow, and GetColumnNames converted size_t indexes to int before adding them to std::vector iterators. On 64-bit systems, in a CSV matrix dimension containing more than 2^31 elements, an index above INT_MAX could wrap to a negative iterator offset and point before the start of the vector, causing undefined behavior, heap memory corruption, or a crash. Triggering the issue requires an extremely large in-memory document,…
CVE-2026-49206Read original ↗ (opens in a new tab) - NVD
CVE-2026-110736 — Godot Engine through 4.7.2 has an out-of-bounds read in the optimized translation loader (core/string/optimized_translation.…
Low · CVSS 3.1 3.6 · Assessor: [email protected]
Godot Engine through 4.7.2 has an out-of-bounds read in the optimized translation loader (core/string/optimized_translation.cpp, OptimizedTranslation::get_message). Offsets read from the hash table of a crafted .translation resource are used as indices into the bucket table without bounds validation; only a single sentinel value is rejected. A crafted file can point an index far past the allocated buffer. Depending on the values, the result is a crash, or a string lookup (tr()) returns raw bytes from elsewhere in…
CVE-2026-110736Read original ↗ (opens in a new tab) - NVD
CVE-2026-110735 — Godot Engine through 4.7.2 has a heap out-of-bounds write in the binary resource loader (core/io/resource_format_binary.cpp,…
Low · CVSS 3.1 2.5 · Assessor: [email protected]
Godot Engine through 4.7.2 has a heap out-of-bounds write in the binary resource loader (core/io/resource_format_binary.cpp, ResourceLoaderBinary::get_unicode_string). A string length is read from the resource file into a signed 32-bit integer and compared against the destination buffer size with a signed comparison, which conditionally resizes the buffer. A negative length value skips the resize; the same value is then passed to the copy routine as an unsigned byte count, where it sign-extends to a huge value, co…
CVE-2026-110735Read original ↗ (opens in a new tab) - NVD
CVE-2026-110734 — Godot Engine through 4.7.2 has a heap out-of-bounds write in the Radiance HDR (.hdr) image decoder (modules/hdr/image_loader…
Low · CVSS 3.1 2.5 · Assessor: [email protected]
Godot Engine through 4.7.2 has a heap out-of-bounds write in the Radiance HDR (.hdr) image decoder (modules/hdr/image_loader_hdr.cpp). The run-length decoding loop expands RLE instructions read from the file into a buffer sized from the image dimensions, without validating that an instruction's repeat/copy count fits the remaining capacity of the row buffer. A crafted .hdr file therefore writes attacker-supplied bytes past the end of the heap allocation, with the overflow length and content controlled by the file.…
CVE-2026-110734Read original ↗ (opens in a new tab) - NVD
CVE-2026-110719 — Portkey AI Gateway 1.14.0 through 1.15.2 contains a server-side request forgery vulnerability that allows unauthenticated at…
Medium · CVSS 4.0 6.9 · Assessor: [email protected]
Portkey AI Gateway 1.14.0 through 1.15.2 contains a server-side request forgery vulnerability that allows unauthenticated attackers to reach loopback and Docker host services because isValidCustomHost trusts localhost-style hosts when TRUSTED_CUSTOM_HOSTS is unset. Attackers can send /v1 requests with a crafted x-portkey-custom-host header, such as via the ollama provider, to make the gateway call internal services and return their responses.
CVE-2026-110719Read original ↗ (opens in a new tab) - NVD
CVE-2026-110718 — TurboDocx html-to-docx through 1.23.1 contains a server-side request forgery vulnerability that allows attackers supplying H…
High · CVSS 4.0 8.2 · Assessor: [email protected]
TurboDocx html-to-docx through 1.23.1 contains a server-side request forgery vulnerability that allows attackers supplying HTML to make the server fetch internal URLs via img src attributes. Attackers can reference loopback, private, or cloud metadata addresses that bypass the loose isValidUrl() check, and read responses embedded in the generated DOCX word/media folder.
CVE-2026-110718Read original ↗ (opens in a new tab) - NVD
CVE-2026-110717 — Janus WebRTC Server through 1.4.3 contains a path traversal vulnerability in the Record&Play plugin that allows unauthentica…
Medium · CVSS 4.0 6.9 · Assessor: [email protected]
Janus WebRTC Server through 1.4.3 contains a path traversal vulnerability in the Record&Play plugin that allows unauthenticated attackers to write files outside recordings_path via the record request filename. Attackers can supply filenames with path separators to create or truncate files ending in -audio.mjr, -video.mjr or -data.mjr anywhere the Janus process can write outside protected folders.
CVE-2026-110717Read original ↗ (opens in a new tab) - NVD
CVE-2026-110716 — unshield through 1.6.2 contains a heap out-of-bounds read vulnerability in unshield_get_file_table() that allows attackers t…
Medium · CVSS 4.0 6.8 · Assessor: [email protected]
unshield through 1.6.2 contains a heap out-of-bounds read vulnerability in unshield_get_file_table() that allows attackers to read past heap allocations via unchecked cabinet header offsets. Attackers can supply a crafted InstallShield cabinet with out-of-range file_table_offset or large file counts to crash the unshield tool or library consumers.
CVE-2026-110716Read original ↗ (opens in a new tab) - NVD
CVE-2026-110715 — MuJS 1.3.6 before 1.3.9 contains a heap out-of-bounds read and write vulnerability in Array.prototype.sort that allows attac…
Medium · CVSS 4.0 6.9 · Assessor: [email protected]
MuJS 1.3.6 before 1.3.9 contains a heap out-of-bounds read and write vulnerability in Array.prototype.sort that allows attackers to corrupt memory by inflating a simple array's length. Attackers can supply JavaScript that enlarges a dense array's length and calls sort, causing Ap_sort_cmp and Ap_sort_swap to access slots past the buffer and crash the process.
CVE-2026-110715Read original ↗ (opens in a new tab) - NVD
CVE-2026-110714 — libsmb2 through 6.2 contains an integer underflow vulnerability in decode_acl that allows malicious SMB servers to trigger h…
High · CVSS 4.0 7.1 · Assessor: [email protected]
libsmb2 through 6.2 contains an integer underflow vulnerability in decode_acl that allows malicious SMB servers to trigger heap out-of-bounds reads via crafted security descriptors. Attackers controlling a server or intercepting unsigned sessions can send an AclSize below 8 in a QUERY_INFO reply, bypassing ACE bounds checks and crashing the client.
CVE-2026-110714Read original ↗ (opens in a new tab) - NVD
CVE-2026-110713 — libsmb2 through 6.2 contains a heap out-of-bounds read vulnerability in smb2_decode_file_fs_volume_info and smb2_decode_file…
High · CVSS 4.0 7.1 · Assessor: [email protected]
libsmb2 through 6.2 contains a heap out-of-bounds read vulnerability in smb2_decode_file_fs_volume_info and smb2_decode_file_fs_attribute_info that allows malicious SMB servers to read past reply buffers. Attackers controlling a server or intercepting unsigned sessions can send crafted QUERY_INFO replies with missing or oversized name lengths to crash the client.
CVE-2026-110713Read original ↗ (opens in a new tab) - NVD
CVE-2026-110712 — libsmb2 through 6.2 contains a heap out-of-bounds read vulnerability in smb2_decode_file_all_info that allows malicious SMB…
High · CVSS 4.0 7.1 · Assessor: [email protected]
libsmb2 through 6.2 contains a heap out-of-bounds read vulnerability in smb2_decode_file_all_info that allows malicious SMB servers to crash clients by sending an unchecked FileNameLength. Attackers controlling the server or performing man-in-the-middle on unsigned sessions can return crafted FileAllInformation replies to smb2_stat or smb2_fstat calls, crashing the client.
CVE-2026-110712Read original ↗ (opens in a new tab) - NVD
CVE-2026-110661 — CGNS through 4.5.2 contains a stack out-of-bounds read vulnerability in ADFI_read_node_header that allows attackers to crash…
Medium · CVSS 4.0 4.8 · Assessor: [email protected]
CGNS through 4.5.2 contains a stack out-of-bounds read vulnerability in ADFI_read_node_header that allows attackers to crash applications by supplying crafted ADF node headers. Attackers can craft .cgns or .adf files whose non-NUL-terminated end tag causes ADFI_stridx_c to scan past disk_node_data, crashing tools like cgnslist.
CVE-2026-110661Read original ↗ (opens in a new tab) - NVD
CVE-2026-110660 — vgmstream through r2117 contains a stack out-of-bounds read vulnerability in the G.722.1/Siren14 decoder in g7221_lib.c, who…
Medium · CVSS 4.0 4.8 · Assessor: [email protected]
vgmstream through r2117 contains a stack out-of-bounds read vulnerability in the G.722.1/Siren14 decoder in g7221_lib.c, whose bit reader refills without checking the data_u32 array end. Attackers can supply crafted .s14 or .sss files that drive decode_vector_quantized_mlt_indices() past the stack buffer during format detection, crashing the application.
CVE-2026-110660Read original ↗ (opens in a new tab) - NVD
CVE-2026-110659 — ELFIO through 3.12 contains a NULL pointer dereference vulnerability in relocation_section_accessor get_entry() that allows…
Medium · CVSS 4.0 6.8 · Assessor: [email protected]
ELFIO through 3.12 contains a NULL pointer dereference vulnerability in relocation_section_accessor get_entry() that allows attackers to crash applications via an unvalidated sh_link index. Attackers can supply a crafted ELF file whose SHT_REL or SHT_RELA section has a dangling sh_link, causing find_hash_section() to dereference null and deny service.
CVE-2026-110659Read original ↗ (opens in a new tab) - NVD
CVE-2026-110658 — Sofia-SIP through 1.13.18 contains a heap out-of-bounds read vulnerability in msg_multipart_parse() that allows unauthentica…
Medium · CVSS 4.0 6.9 · Assessor: [email protected]
Sofia-SIP through 1.13.18 contains a heap out-of-bounds read vulnerability in msg_multipart_parse() that allows unauthenticated remote attackers to crash the process by sending oversized MIME boundaries. Attackers can send an INVITE with a multipart Content-Type whose boundary exceeds the body length, causing memcmp to read past the heap buffer and crash the process.
CVE-2026-110658Read original ↗ (opens in a new tab) - NVD
CVE-2026-110657 — Khronos NNEF-Tools nnef through 1.0.10 and nnef-tools through 1.0.11 contain a path traversal vulnerability that allows atta…
Medium · CVSS 4.0 4.8 · Assessor: [email protected]
Khronos NNEF-Tools nnef through 1.0.10 and nnef-tools through 1.0.11 contain a path traversal vulnerability that allows attackers to write files outside the model directory via crafted variable labels. Attackers can supply a graph.nnef with '../' sequences or absolute paths in labels to create or overwrite '.dat' files when users convert, save, or generate weights.
CVE-2026-110657Read original ↗ (opens in a new tab) - NVD
CVE-2026-110656 — miniupnpc through 2.3.3 contains a one-byte heap out-of-bounds read vulnerability in the minixml parseelt function's namespa…
Low · CVSS 4.0 2.3 · Assessor: [email protected]
miniupnpc through 2.3.3 contains a one-byte heap out-of-bounds read vulnerability in the minixml parseelt function's namespace-prefix handling that skips an end-of-buffer check after advancing past ':'. A malicious or spoofed UPnP gateway on the local network can send a device description or SOAP reply ending in ':' within an element name to crash the client.
CVE-2026-110656Read original ↗ (opens in a new tab) - NVD
CVE-2026-110655 — miniupnpc through 2.3.3 contains a one-byte heap out-of-bounds read vulnerability in the minixml parseatt function that allo…
Low · CVSS 4.0 2.3 · Assessor: [email protected]
miniupnpc through 2.3.3 contains a one-byte heap out-of-bounds read vulnerability in the minixml parseatt function that allows malicious UPnP gateways to read past buffer bounds via crafted replies. Attackers on the local network can spoof a gateway serving device descriptions or SOAP responses ending in '=' to crash the client.
CVE-2026-110655Read original ↗ (opens in a new tab) - NVD
CVE-2026-110654 — libzvbi through 0.2.45 contains an out-of-bounds write vulnerability in the Teletext decoder that allows attackers to corrup…
Medium · CVSS 4.0 6.9 · Assessor: [email protected]
libzvbi through 0.2.45 contains an out-of-bounds write vulnerability in the Teletext decoder that allows attackers to corrupt memory by supplying unvalidated DRCS pixel-mode values in X/28/3 packets. Attackers can send a crafted Teletext stream decoded via vbi_decode with every slot set to DRCS_MODE_6_5_4, causing convert_drcs to overflow chars[48][60] and crash the application.
CVE-2026-110654Read original ↗ (opens in a new tab)
Summaries are excerpts from the publishers. The default Advisories view includes CISA KEV, CISA Industrial and CERT-EU. When several scores exist, PATCHBAY shows the newest valid CVSS version, then prefers a primary assessment, NVD, and a stable assessor ordering. Open the original for all assessments. CISA Known Exploited dates indicate catalog additions. This product uses data from the NVD API but is not endorsed or certified by the NVD.